Siemens SIMATIC WinCC

Name: Siemens SIMATIC WinCC
Brand: Siemens

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

5critical21high14medium0low

updated 2026-10-27

vulnerabilities (66)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-44228US	critical10.0OT critical	100.0% (100th)	KEV	V7.4 SP1	2021-12-10	< V7.4 SP1
CVE-2026-31431US	—OT critical	98.1% (100th)	KEV	no fix	2026-04-22	≤ vers:unknown/*
CVE-2026-18963US	—	4.68% (92nd)	Exploit	no fix	2026-08-18	≤ vers:unknown/*
CVE-2017-12069US	high8.2	2.90% (87th)	—	V7.2	2017-08-30	2 versions
CVE-2021-40142US	high7.5	2.56% (85th)	—	V8.0	2021-08-27	2 versions
CVE-2017-2684US	critical9.0	1.99% (81st)	—	V7.4_SP1	2017-02-22	< V7.4_SP1
CVE-2017-6867US	medium4.9	1.92% (80th)	—	7.4 SP1	2017-05-11	2 versions
CVE-2014-4682US	medium5.0	1.69% (77th)	—	7.3	2014-07-24	< 7.3
CVE-2016-9160US	high8.1	1.42% (73rd)	—	7.2	2016-12-17	< 7.2
CVE-2014-4684US	medium6.0	1.34% (71st)	—	7.3	2014-07-24	< 7.3
CVE-2014-4683US	medium4.9	1.22% (69th)	—	7.3	2014-07-24	< 7.3
CVE-2026-67367DE	high8.6	1.11% (66th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2014-4686US	medium6.8OT elevated	1.09% (65th)	—	7.3	2014-07-24	< 7.3
CVE-2026-62645DE	critical9.8OT elevated	0.65% (51st)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2026-54801US	—	0.62% (49th)	—	no fix	2026-07-09	≤ vers:unknown/*
CVE-2024-42512US	—	0.60% (48th)	—	V8.0 Update 3	2025-02-10	< V8.0 Update 3
CVE-2024-42513US	—	0.58% (47th)	—	V8.0 Update 3	2025-02-10	< V8.0 Update 3
CVE-2026-62650DE	high8.8OT elevated	0.57% (47th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2026-62649DE	high7.5	0.57% (47th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2026-62648DE	high7.5	0.57% (47th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2026-62647DE	high7.4	0.56% (47th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2010-2772US	high7.8OT elevated	0.55% (46th)	—	V7.0_SP2_Update_1_V_7.0.2.1	2010-07-22	< V7.0_SP2_Update_1_V_7.0.2.1
CVE-2026-62646DE	high7.4	0.51% (43rd)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2024-42384US	high7.5	0.48% (42nd)	—	no fix	2024-11-18	≤ vers:unknown/*
CVE-2025-40575US	medium5.3	0.48% (41st)	—	no fix	2025-05-13	≤ vers:unknown/*
CVE-2026-46746US	—	0.43% (37th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-54798US	—OT elevated	0.41% (35th)	—	no fix	2026-07-09	≤ vers:unknown/*
CVE-2026-58113DE	medium6.1	0.39% (33rd)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2024-42386US	high7.5	0.38% (32nd)	—	no fix	2024-11-18	≤ vers:unknown/*
CVE-2014-4685US	medium4.6	0.36% (30th)	—	7.3	2014-07-24	< 7.3
CVE-2026-62652DE	medium5.3	0.34% (28th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2020-10048US	medium5.5OT elevated	0.34% (27th)	—	V7.5_SP2	2021-02-09	2 versions
CVE-2026-50093DE	critical9.0	0.32% (25th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2024-42391US	medium5.3	0.30% (23rd)	—	no fix	2024-11-18	≤ vers:unknown/*
CVE-2023-28829US	high8.8	0.29% (22nd)	—	V8.0	2023-06-13	3 versions
CVE-2026-62653DE	medium6.8	0.28% (20th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2025-40578US	—	0.28% (20th)	—	no fix	2025-05-13	≤ vers:unknown/*
CVE-2025-40577US	—	0.28% (20th)	—	no fix	2025-05-13	≤ vers:unknown/*
CVE-2025-40576US	—	0.28% (20th)	—	no fix	2025-05-13	≤ vers:unknown/*
CVE-2024-42392US	high7.5	0.24% (15th)	—	no fix	2024-11-18	≤ vers:unknown/*
CVE-2026-46747US	medium5.3	0.24% (15th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-54800US	—OT elevated	0.23% (14th)	—	no fix	2026-07-09	≤ vers:unknown/*
CVE-2024-56182US	—	0.21% (12th)	—	no fix	2025-03-11	≤ vers:unknown/*
CVE-2024-56181US	—	0.21% (12th)	—	no fix	2025-03-11	≤ vers:unknown/*
CVE-2023-30897US	high7.8	0.21% (11th)	—	V7.5.2.13	2023-06-13	3 versions
CVE-2025-30033US	—	0.21% (11th)	—	V8.1 Update 3	2025-08-12	2 versions
CVE-2026-46748US	high7.8	0.21% (11th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-34223DE	high8.2	0.19% (9th)	—	no fix	2026-09-08	≤ vers:unknown/*
CVE-2025-40582US	—	0.19% (8th)	—	no fix	2025-05-13	≤ vers:unknown/*
CVE-2025-40808US	—	0.19% (8th)	—	no fix	2026-06-09	≤ vers:unknown/*

showing 50 of 66

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-787Out-of-bounds Write5 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-732Incorrect Permission Assignment for Critical Resource4 CVEs
CWE-264CWE-2643 CVEs
CWE-288Authentication Bypass Using an Alternate Path or Channel3 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer2 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')2 CVEs
CWE-121Stack-based Buffer Overflow2 CVEs

sources (5)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)47 CVEs
USCISA CSAF OT advisories (ICS)15 CVEs
DECERT-Bund (BSI CSAF)5 CVEs
DESiemens ProductCERT (CSAF)5 CVEs
EUEU Vulnerability Database (ENISA)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan